fix/additional security

src/Microsoft.OpenApi/Models/OpenApiParameter.cs

@@ -165,50 +165,25 @@
 
             writer.WriteEndObject();
         }
-
-        /// <inheritdoc/>
-        public void SerializeAsV2(IOpenApiWriter writer)
+        /// <summary>
+        /// Write the "in" property for V2 serialization.
+        /// </summary>
+        /// <param name="writer">Writer to use for the serialization</param>
+        internal virtual void WriteInPropertyForV2(IOpenApiWriter writer)
         {
-            Utils.CheckArgumentNull(writer);
-
-            writer.WriteStartObject();
-
-            // in
-            if (this is OpenApiFormDataParameter)
-            {
-                writer.WriteProperty(OpenApiConstants.In, "formData");
-            }
-            else if (this is OpenApiBodyParameter)
-            {
-                writer.WriteProperty(OpenApiConstants.In, "body");
-            }
-            else
-            {
-                writer.WriteProperty(OpenApiConstants.In, In?.GetDisplayName());
-            }
-
-            // name
-            writer.WriteProperty(OpenApiConstants.Name, Name);
-
-            // description
-            writer.WriteProperty(OpenApiConstants.Description, Description);
-
-            // required
-            writer.WriteProperty(OpenApiConstants.Required, Required, false);
-
-            // deprecated
-            writer.WriteProperty(OpenApiConstants.Deprecated, Deprecated, false);
-
-            var extensionsClone = Extensions is not null ? new Dictionary<string, IOpenApiExtension>(Extensions) : null;
+            writer.WriteProperty(OpenApiConstants.In, In?.GetDisplayName());
+        }
 
-            // schema
-            if (this is OpenApiBodyParameter)
-            {
-                writer.WriteOptionalObject(OpenApiConstants.Schema, Schema, (w, s) => s.SerializeAsV2(w));
-            }
+        /// <summary>
+        /// Write the request body schema for V2 serialization.
+        /// </summary>
+        /// <param name="writer">Writer to use for the serialization</param>
+        /// <param name="extensionsClone">Extensions clone</param>
+        internal virtual void WriteRequestBodySchemaForV2(IOpenApiWriter writer, Dictionary<string, IOpenApiExtension>? extensionsClone)
+        {
             // In V2 parameter's type can't be a reference to a custom object schema or can't be of type object
             // So in that case map the type as string.
-            else if (Schema is OpenApiSchemaReference { UnresolvedReference: true } || (Schema?.Type & JsonSchemaType.Object) == JsonSchemaType.Object)
+            if (Schema is OpenApiSchemaReference { UnresolvedReference: true } || (Schema?.Type & JsonSchemaType.Object) == JsonSchemaType.Object)
             {
                 writer.WriteProperty(OpenApiConstants.Type, "string");
             }
@@ -239,7 +214,7 @@
                 if (targetSchema is not null)
                 {
                     targetSchema.WriteAsItemsProperties(writer);
                     var extensions = Schema?.Extensions;
                     if (extensions != null)
                     {
                         foreach (var key in extensions.Keys)
@@ -256,7 +231,7 @@
 
                 if (this.In == ParameterLocation.Query && Schema?.Type == JsonSchemaType.Array)
                 {
                     if (this.Style == ParameterStyle.Form && this.Explode == true)
                     {
                         writer.WriteProperty("collectionFormat", "multi");
                     }
@@ -270,7 +245,34 @@
                     }
                 }
             }
+        }
+
+        /// <inheritdoc/>
+        public void SerializeAsV2(IOpenApiWriter writer)
+        {
+            Utils.CheckArgumentNull(writer);
+
+            writer.WriteStartObject();
+
+            // in
+            WriteInPropertyForV2(writer);
 
+            // name
+            writer.WriteProperty(OpenApiConstants.Name, Name);
+
+            // description
+            writer.WriteProperty(OpenApiConstants.Description, Description);
+
+            // required
+            writer.WriteProperty(OpenApiConstants.Required, Required, false);
+
+            // deprecated
+            writer.WriteProperty(OpenApiConstants.Deprecated, Deprecated, false);
+
+            var extensionsClone = Extensions is not null ? new Dictionary<string, IOpenApiExtension>(Extensions) : null;
+
+            // schema
+            WriteRequestBodySchemaForV2(writer, extensionsClone);
             //examples
             if (Examples != null && Examples.Any())
             {
@@ -315,12 +317,24 @@
     /// </summary>
     internal class OpenApiBodyParameter : OpenApiParameter
     {
+        internal override void WriteRequestBodySchemaForV2(IOpenApiWriter writer, Dictionary<string, IOpenApiExtension>? extensionsClone)
+        {
+            writer.WriteOptionalObject(OpenApiConstants.Schema, Schema, (w, s) => s.SerializeAsV2(w));
+        }
+        internal override void WriteInPropertyForV2(IOpenApiWriter writer)
+        {
+            writer.WriteProperty(OpenApiConstants.In, "body");
+        }
     }
 
     /// <summary>
     /// Form parameter class to propagate information needed for <see cref="OpenApiParameter.SerializeAsV2"/>
     /// </summary>
     internal class OpenApiFormDataParameter : OpenApiParameter
     {
+        internal override void WriteInPropertyForV2(IOpenApiWriter writer)
+        {
+            writer.WriteProperty(OpenApiConstants.In, "formData");
+        }
     }
 }

src/Microsoft.OpenApi/Writers/FormattingStreamWriter.cs

@@ -19,12 +19,13 @@ public class FormattingStreamWriter : StreamWriter
         public FormattingStreamWriter(Stream stream, IFormatProvider formatProvider)
             : base(stream)
         {
-            this.FormatProvider = formatProvider;
+            _formatProvider = formatProvider;
         }
+        private readonly IFormatProvider _formatProvider;
 
         /// <summary>
         /// The <see cref="IFormatProvider"/> associated with this <see cref="FormattingStreamWriter"/>.
         /// </summary>
-        public override IFormatProvider FormatProvider { get; }
+        public override IFormatProvider FormatProvider { get => _formatProvider; }
     }
 }